Privacy

Controller

The controller is the company named on this site, at the address shown in the footer. Data protection enquiries go to the contact address there.

What we collect

Contact and readiness forms: your name, company, email address, your role, and the message you write.

The readiness check: your answers to its questions. Product family, catalogue size, where your product data lives, how you produce declarations today, whether you use a data dictionary, your EPD status, and your sense of urgency. Together with the score and level computed from them.

Standards Watch: your email address and the product families you select.

Server logs: IP address, request time, page requested and user agent, recorded by the hosting infrastructure.

There is no public upload on this site. If you send us declarations, you send them by email after we reply.

Why, and on what legal basis

Form submissions are used to reply to you and to prepare the readiness assessment you asked for. The basis is the performance of a contract or steps taken at your request (Art. 6(1)(b)), and our legitimate interest in responding to business enquiries (Art. 6(1)(f)).

Standards Watch is consent (Art. 6(1)(a)). Subscription is confirmed by a link sent to your address, and every notification carries a one-click unsubscribe.

Server logs are kept for security and to keep the service working, on the basis of legitimate interest (Art. 6(1)(f)).

How long we keep it

Contact, readiness and enquiry records are kept for 24 months from the date you send them, then deleted automatically.

Standards Watch subscriptions are kept for as long as you stay subscribed. Unsubscribing deactivates the subscription immediately and it is deleted 36 months later, together with its family selections and any queued notifications.

Server logs are retained by the hosting provider according to its own retention period.

These periods are enforced by a scheduled job, not only stated here. You can ask for erasure at any time before they expire.

Who else sees it

Our hosting provider, which processes data on our behalf in order to run the site and store its database.

An email provider, once one is configured for sending notifications. Until then, Standards Watch notifications are queued and not dispatched.

Analytics are not enabled on this site. If that changes, this policy will say so and what is collected before it is switched on.

We do not sell personal data and we do not share it for advertising.

Transfers outside the EEA

We keep processing within the EU or EEA where we can. If a processor outside it becomes necessary, the transfer will rest on an adequacy decision or on the European Commission's standard contractual clauses, and this policy will name the processor.

Cookies

This site sets no tracking or advertising cookies.

Your language choice and, on the private platform, your session token are kept in your browser's own storage. They are not cookies, are not sent to us for tracking, and are cleared when you clear your browser data.

Your rights

You have the right of access to your data, to rectification, to erasure, to restriction of processing, to data portability, and to object to processing based on legitimate interest. Where processing rests on consent, you may withdraw it at any time.

To exercise any of these, write to the contact address on this site. We will respond within one month.

If you believe we have handled your data wrongly, you may complain to the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese supervisory authority.